Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92716Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation

Critical 9.6

In plain English

A critical-severity authorization bypass via user-controlled key in Shuffle from Shuffle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.

Affected products (as reported)

Vendor	Product	Versions
Shuffle	Shuffle	0 – through 2.2.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/geo-chen/oss/blob/main/shuffle.md third-party-advisory
https://github.com/Shuffle/Shuffle product
https://github.com/Shuffle/shuffle-shared/blob/v1.2.50/shared.go#L9888-L9912 technical-description
https://github.com/Shuffle/shuffle-shared/commit/c1b582e91b429bc7d5ad02e6c22f98234ec67615 patch
VulnCheck Advisory: Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation third-party-advisory